GTP is a tunneling protocol used in mobile core networks to allow subscriber mobility. For example, referring to FIG. 1, when a subscriber terminal 100 attaches to an e-Node B 102, GTP tunnels are established between the Mobility Management Entity (MME) 108, and Serving Gateway (S-GW) 104, and between the Serving Gateway (S-GW) 104, add the Packet Data Network Gateway (P-GW) 106. These tunnels are established by creating a session for the subscriber when he attaches to the network, building a data plane connection (shown in purple in FIG. 1) and encapsulating that data into GTP tunnels. The tunnels have various tunnel identifiers (TEIDs) along the path, associated with the temporary subscriber session, and are maintained by a control plane connection between the nodes (shown in black in FIG. 1). The control plane connection is formed, in order, between the subscriber User Equipment (UE) 100 and eNodeB 102, between eNodeB 102 and MME 108 (named S1-MME interface), between MME 108 and the Home Subscriber Server (HSS) 110 (named S6a interface), between MME 108 and SGW 104 (named S11 interface) and between SGW 104 and PGW 106 (named S5/8 interface).
It should be noted that GTP user plane tunnels only exist between the eNodeB and the S-GW on the S-GW side of PGW 106 but not on the packet network side of P-GW 106. As a result, there are no GTP TEIDs on the packet network side of P-GW 106.
In order to obtain a complete view of the network for performance monitoring or debugging, or other purposes, passive optical or electrical network taps may be placed at any or all of the interfaces illustrated in FIG. 1. These network taps may passively copy packets from the various interfaces, and send the tapped packets to a load balancer or filter for intermediate processing before it is sent to network visibility tools. Standard load balancers operate on the outer IPs and ports of the packets, are inefficient in these contexts, as because it is encapsulated and carries the outer IPs of the EPC notes, traffic for one subscriber can end up on multiple probes. Advanced load balancers can either operate stateless on the subscriber inner-IP of the GTP packets, making sure that at least the user plane for a session end on the same tool while generally flooding GTP control plane, or can go a step further and correlate GTP control and user plane sessions with each other, and forward the corresponding packets for a given subscriber to the same tool. Accordingly, there exists a need and it is of great value to correlate and filter tapped GTP and non-GTP packets using network visibility components